Third-party harassment is harassment at work by someone other than the employer or its employees. From 30 October 2026, employers in Great Britain can be liable when an outsider harasses an employee during their work and the employer has failed to take all reasonable steps to prevent it (Employment Rights Act 2025, s. 21; Commencement Regulations, 2026, reg. 3).
Acas illustrates the management failure through a convenience-store example. Two new workers covering late weekend shifts receive threats from customers over reporting shoplifting. One reports racist abuse. They follow the handbook and tell the owner, who dismisses the behaviour as part of the job and threatens their employment if they complain. This is a guidance example, rather than a tribunal finding (Acas, 2026b).
The workers knew how to report. What they needed from the owner was action to protect them during future customer contact. For employers reviewing their arrangements, the next shift is a useful place to start.
Customers and clients are familiar examples, but third parties also include visitors, contractors, patients and service users. Contact can happen in person, by phone or online, including through work away from the employer’s premises (Acas, 2026b).
Third-party sexual harassment is only part of the picture. Under section 26 of the Equality Act, harassment includes unwanted conduct related to age, disability, gender reassignment, race, religion or belief, sex or sexual orientation. Its purpose or effect must be to violate someone’s dignity or create an intimidating, hostile, degrading, humiliating or offensive environment (Equality Act 2010, s. 26).
Sexual harassment involves unwanted conduct of a sexual nature meeting that purpose-or-effect test. It differs from harassment related to sex, such as degrading remarks about women’s ability to do a job. The Act also covers less favourable treatment because someone rejected or submitted to unwanted sexual conduct or harassment related to sex or gender reassignment meeting that test.
When assessing effect, the person’s perception, the circumstances and whether it is reasonable for the conduct to have that effect all matter. Offensive behaviour is therefore not automatically Equality Act harassment. Other abuse may still need action to protect staff. Marriage and civil partnership, and pregnancy and maternity, are not standalone harassment categories. Harassment related to sex or other discrimination protections may still apply.
Employment protection also extends beyond conventional payroll employees to some people contracted personally to work. Check the actual arrangement before excluding someone labelled self-employed or deciding responsibility for an agency worker (Equality Act 2010, s. 83).
The new rule makes the employer’s preventive action central. Section 21 inserts sections 40(1A)–(1C) into the Equality Act. Liability arises where third-party harassment occurs in the course of employment and the employer failed to take all reasonable steps to prevent it. An incident alone does not establish liability (Employment Rights Act 2025, s. 21).
One incident can be enough. The new provision does not require two earlier incidents before the employer can be liable.
The existing duty is explained by Acas (2026a). Sections 20 and 21 of the 2025 Act introduce the changes, with commencement fixed by regulation 3 of the 2026 Regulations. Employers should already be assessing sexual harassment risks rather than waiting for the new date.
The wider October 2026 employment-law changes affect other management decisions, but the immediate task here is to examine how staff encounter outsiders and what protection works during that contact.
The following illustrations show possible exposure and a proportionate management response. Whether conduct meets the legal definition depends on the circumstances.
In care, decisions must account for capacity, clinical needs, safeguarding and service obligations. A blanket instruction to refuse care is inappropriate. HSE recommends individual assessment through care planning, with relevant information and preventive measures communicated to exposed staff (HSE, 2026).
Harassment by clients creates the same practical question as harassment by customers. Who can change the working arrangements when the relationship is commercially important?
For the receptionist, recording the contractor’s remarks is only the beginning. Someone must decide what happens during the rest of that visit and before the contractor returns. A workable response follows a clear sequence.
First, address immediate safety. Arrange support, interrupt contact where needed and use emergency procedures if there is a threat. Workers should not have to confront the outsider themselves.
Next, listen privately and record what the person reports. Note the conduct, timing, witnesses and available messages or other evidence. A worker need not assemble a complete case before raising a concern. Explain who will need information to act, without promising absolute secrecy.
Apply a fair complaint process, keeping an open mind and considering the person’s wishes alongside the seriousness of the report. Acas advises prompt, sensitive handling that is fair to everyone involved (Acas, 2025). Accessible alternatives are needed if the usual manager is involved or unavailable. For sexual conduct, recording and reporting sexual harassment should be clear to the affected worker.
Then involve HR and the person responsible for the customer account or contractor relationship. Give a named manager authority to pause a transaction, change contact arrangements or seek a restriction. The contract owner should follow up with the supplier, while HR oversees the complaint process. Agree who will check implementation and when the worker will hear back.
Discuss protective arrangements with the worker. Moving them to a worse shift or removing opportunities because they complained can create further harm. Treating someone unfavourably because they made a protected complaint can amount to victimisation (Acas, 2026c).
Prevention starts by looking closely at the contact staff actually have. A policy written mainly around colleague behaviour can overlook a customer collection desk or a contractor’s regular visits.
The Equality and Human Rights Commission’s (EHRC) 2024 technical guidance illustrates this with a distribution centre. The employer updates policies, trains staff and managers and plans reviews. Yet it overlooks customers collecting orders, despite a sexual harassment incident six months earlier. The example concerns the sexual harassment preventative duty and shows how extensive internal activity can miss an external source of exposure (EHRC, 2024, para. 3.26).
Ask workers where contact becomes difficult, then assess exposure by role, location, shift and communication channel. Include temporary staff, cleaners and maintenance teams. Consider customer and contractor conduct expectations, how those expectations are communicated and what happens when they are breached.
Test the response arrangements against normal working conditions. Can late-shift staff reach someone authorised to act? Does the facilities manager know which supplier contact will respond? A de-escalation course cannot supply missing management cover.
Where threats or aggression create safety risks, staffing, alarms, layout or security measures may be appropriate. HSE recommends controls matched to the assessed risks and training relevant to the work (HSE, n.d.). These safety duties sit alongside the Equality Act tests.
What counts as all reasonable steps depends on the organisation and its risks. Record the measures selected, the person implementing each one and how effectiveness will be checked. Record why a proposed measure was rejected too (Acas, 2026b). These are practical recommendations, not an exhaustive statutory checklist or a guarantee against liability.
Use five checks to establish whether a report can lead to effective protection:
- Roles and contact points exposed to third-party harassment have been identified with workers.
- Prevention measures have been implemented and checked in practice.
- Reporting routes are accessible and managers know their response authority.
- Someone owns escalation with the customer, client or contractor.
- Incidents, actions and effectiveness are reviewed, with follow-up agreed with affected staff.
Return to the convenience store. Before the next shift, the workers should know who will respond, how support will arrive and what has changed about their exposure to abusive customers. The manager should be able to explain and demonstrate those arrangements.
Human Focus’s Bullying and Harassment Training supports recognising, preventing and responding to workplace bullying and harassment. Employers need to connect that awareness to the authority, reporting routes and working arrangements their teams will use.
